Identity and access management
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
With an integration between ADP Workforce Now and Microsoft Entra ID, every new employee from ADP gets a Microsoft account with job title, department and manager, and the new work address goes back to ADP. A departure HR records in advance in ADP appears straight away as a leaving date in Entra ID, so the block and the offboarding are ready for the right day.
What the integration does
Organisations that use ADP Workforce Now for HR and payroll, often for colleagues in the United States or Canada, and Microsoft 365 for everyone, frequently create accounts through a ticket. HR then retypes the work address into ADP, and a departure that has been in ADP for weeks only reaches IT on the last day.
- The organisation registers the integration in ADP and gives it read access to workers, write access to the business email address and the related notifications.
- On a hire KoppelHet fetches the full worker and creates the Microsoft account with job title, department and manager of the main position.
- KoppelHet writes the new work address back to ADP and puts the photo from ADP on the account.
- If HR records a departure in advance, KoppelHet sets the leaving date in Entra ID straight away; the offboarding in Entra ID runs on that date.
- Every day KoppelHet compares all workers in ADP with Entra ID, including archived ones, and reports differences.
Back: After the account is created KoppelHet writes the new business email address into ADP Workforce Now.
What to watch for with ADP Workforce Now and Microsoft Entra ID
- If HR records a departure with a future date in ADP, the position is terminated straight away, but the worker stays active until that date. KoppelHet reads the end date of the position and sets it as the leaving date in Entra ID, so the offboarding tasks in Entra ID can start days in advance.
- ADP Workforce Now can add and change a worker's business email address through the API, also in the new generation of Workforce Now. KoppelHet therefore writes the address of the new Microsoft account back to ADP, so HR does not need to retype it.
- In ADP you can set per user which workers they may see, and that also applies to the integration, which gets the profile for Marketplace applications. That is how we limit the integration to the companies or departments that get an account in this Microsoft environment.
- If a manager is terminated in ADP, ADP does not assign their team a new manager. In Entra ID the team would then hang under a blocked account. KoppelHet reports those workers to HR and keeps the old manager until ADP has a new one, so approvals do not go to nobody.
- ADP sends a notification when a photo is uploaded or removed, and provides the photo through its own address. KoppelHet puts a new photo on the Microsoft account straight away and removes it when HR deletes it in ADP.
- A normal request in ADP returns 50 workers at a time. For the initial load KoppelHet requests up to 1,000 workers at a time asynchronously. The new generation of Workforce Now does not have that route; there we read in parts of 50.
- ADP returns date of birth and social security number only partially by default. Microsoft does not need them, so KoppelHet does not request them unmasked.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this also work with Active Directory in our own network?
Yes, KoppelHet then writes to Active Directory through an agent, with the same rules for key, manager and leaving date.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP Workforce Now through the Worker Management API: GET /hr/v2/workers (50 per page by default; with Prefer: respond-async up to 1,000, not in WFN Next Gen), Content-Type application/json;archived=true for archived workers, sensitive fields masked unless application/json;masked=false. Notifications include worker.hire, worker.rehire, worker.terminate and worker.photo.upload/remove. OAuth 2.0 client credentials with a client certificate.
- Write-back with /events/hr/v1/worker.business-communication.email.add and .email.change. With a future terminationDate the work assignment is Terminated and the worker ACTIVE until the date (Worker Termination API Guide). Terminating a manager does not assign a new manager (known limitation US1401391). Access through People Access on the Marketplace Data Connector Application Profile.
- To Entra ID through Microsoft Graph (user with employeeId, givenName, surname, displayName, userPrincipalName, jobTitle, department, manager, employeeHireDate, employeeLeaveDateTime with User-LifeCycleInfo.ReadWrite.All, accountEnabled; photo through PUT photo/$value).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP Workforce Now | Field in Microsoft Entra ID | Notes |
|---|---|---|
associateOID | employeeId | Unique across ADP |
Legal name of preferred name | givenName, surname, displayName | |
Job title van de hoofdpositie | jobTitle | |
Department (homeOrganizationalUnits) | department | |
reportsTo | manager | |
Hire date | employeeHireDate | |
Termination date van de positie | employeeLeaveDateTime en accountEnabled | |
Corporate contact photo | Profielfoto | |
mail (Entra ID) | Work email (businessCommunication) | Return to ADP |
Related
ADP Workforce Now → 4PS Construct
ADP Workforce Now to 4PS Construct integration: employees with company, dimensions and statistics group in 4PS
ADP Workforce Now → Active Directory
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
ADP Workforce Now → AllSolutions
ADP Workforce Now to AllSolutions integration: employees with department, cost centre and manager in AllSolutions